Backup Is Not the Same as Disaster Recovery

These two terms are often used together, but they aren’t quite the same thing.

Backup

A backup is a copy of your data, applications or system information that can be used to recover information after loss or damage.

Disaster Recovery

Disaster recovery is the broader process of restoring technology and business operations after a significant disruption.

That can involve:

Data

Computers

Servers

Applications

Microsoft 365

Networks

Configuration

User access

Business processes

In simple terms:

Backup answers:

“Do we have a copy?”

Disaster recovery asks:

“Can we actually get the business running again?”

You need both.

Why Business Backups Matter

Your business data may include:

Customer records

Financial information

Contracts

Invoices

Emails

Documents

Projects

Databases

Photos

Intellectual property

Staff information

Business applications

Losing that information can be expensive.

The impact isn’t limited to the cost of replacing a computer.

You may also face:

Lost productivity

Missed deadlines

Customer disruption

Lost revenue

Recovery costs

Reputational damage

Regulatory obligations

Business interruption

The Australian Cyber Security Centre recommends regular backups because they can help businesses recover information after data loss, damage, theft or cyber incidents.

What Can Cause Data Loss?

Data can disappear for many reasons.

Hardware failure

A storage device fails, and important information becomes inaccessible.

Accidental deletion

Someone deletes a file or folder they didn’t intend to remove.

Software failure

An application or operating-system problem damages or prevents access to information.

Malware

Malicious software can corrupt, delete or encrypt data.

Ransomware

Attackers can encrypt business files and demand payment for their release.

Account compromise

An attacker gains access to a cloud account and modifies or deletes information.

Theft

A laptop or other device containing business information is stolen.

Physical disaster

Fire, flood, power problems or other events can damage equipment.

Human error

Sometimes the cause is simply someone making a mistake.

A good backup strategy considers more than one failure scenario.

Ransomware & Business Backups

Ransomware is one of the clearest reasons businesses need resilient backups.

Ransomware can encrypt files and prevent a business from accessing important information. The ACSC recommends maintaining backups as part of ransomware resilience and advises ensuring backups are not themselves compromised.

Imagine your business has:

20 computers

A file server

Microsoft 365

Shared documents

Accounting data

and ransomware reaches your environment.

If your only “backup” is a drive permanently connected to the same network, the backup may be exposed to the same incident.

That’s why backup architecture matters.

The question isn’t simply:

“Do you have backups?”

It’s:

“Are your backups protected from the same failure that could destroy your production data?”

The Backup We Have Might Not Be Enough

One of the most dangerous assumptions in IT is:

“The backup software says successful, so we’re protected.”

A successful backup job doesn’t necessarily prove that your business can recover.

You also need to consider:

Can the data be restored?

How quickly can it be restored?

Is the backup complete?

Is it recent enough?

Are multiple systems backed up?

Are configuration settings protected?

Are backups protected from deletion?

Are credentials secure?

What happens if the primary backup system fails?

What happens during ransomware?

The ACSC specifically recommends testing restoration rather than waiting until an actual incident to discover whether recovery works.

Backup Testing

This is one of the most important parts of our approach.

A backup that has never been restored is an assumption.

A successfully tested restoration provides evidence.

Testing can involve restoring:

Individual files

Folders

Applications

System images

Virtual machines

Databases

Microsoft 365 data

Other critical information

The appropriate test depends on your environment.

The ACSC’s Essential Eight guidance states that restoration of data, applications and settings should be tested as part of disaster-recovery exercises, including at least annually at the relevant maturity levels.

What Should Your Business Back Up?

Not every organisation has the same requirements.

Depending on your environment, important information may include:

Documents

Databases

Accounting systems

Customer information

Email

Microsoft 365 data

SharePoint

OneDrive

Servers

Application data

Configuration

Virtual machines

Network devices

Critical business applications

The first step is therefore not:

“Which backup product should we buy?”

It is:

“What information would seriously hurt the business if we lost it?”

Business-Critical Data

Different data can have different levels of importance.

For example:

Critical

Information required to operate the business.

Important

Information that would cause significant disruption if lost.

Recoverable

Information that could be recreated or obtained elsewhere.

This distinction can influence:

Backup frequency

Retention

Recovery priority

Storage

Cost

Recovery objectives

Backup strategy should follow business priorities.

Not the other way around.

Recovery Point Objective — RPO

RPO stands for Recovery Point Objective.

It answers:

“How much data can we afford to lose?”

For example:

If your RPO is four hours, your recovery strategy needs to minimise the possibility of losing more than approximately four hours of data.

A business processing transactions throughout the day may have very different requirements from a business whose data changes only occasionally.

Recovery Time Objective — RTO

RTO stands for Recovery Time Objective.

It answers:

“How quickly do we need to be operational again?”

For example:

A business may decide that:

Email should be restored quickly.

Critical applications need priority.

Some historical files can wait.

Non-essential systems can be restored later.

RTO helps determine recovery priorities.

RPO + RTO = A More Useful Recovery Strategy

These two concepts help turn vague statements such as:

“We need good backups.”

into something measurable.

For example:

RPO: No more than four hours of critical data loss.

RTO: Critical systems restored within eight hours.

Those objectives can then influence the backup and recovery design.

Not every business needs the same numbers.

The correct targets depend on the cost of downtime and data loss.

Backup Frequency

A backup strategy should reflect how quickly your data changes and how much loss the business can tolerate.

Possible approaches include:

Continuous or near-continuous protection

Multiple backups per day

Daily backups

Weekly retention

Monthly retention

Long-term archival

There is no universal “best” frequency.

A business that processes hundreds of transactions every day has different requirements from one that changes a handful of documents each week.

Backup Retention

Backing up every day doesn’t answer the question:

“How far back can we recover?”

Retention determines how long previous backup versions remain available.

This can matter when:

A file is deleted, and nobody notices immediately.

Malware remains undetected.

A compromised account changes data.

Ransomware encrypts files over time.

An older version of a document is required.

Retention should be based on business requirements, not simply whatever the software’s default setting happens to be.

The 3-2-1 Principle

A commonly used backup concept is the 3-2-1 approach:

3

Keep multiple copies of important data.

2

Use different types of storage or media.

1

Keep at least one copy separate from the primary environment.

The exact implementation should reflect your business, technology and risk profile.

For modern environments, businesses may also consider immutable or otherwise protected backup copies and geographically separate recovery options.

The principle is simple:

Don’t put all your recovery eggs in one basket.

Offsite Backups

If every copy of your data is physically located in the same office, a physical disaster could affect all of them.

Offsite protection can help reduce that risk.

Depending on the environment, this could involve:

Cloud storage

Offsite replication

Secondary infrastructure

Secure external media

Another physical location

The ACSC gives examples of backup arrangements that include offsite copies and emphasises secure, resilient backup practices.

Cloud Backup

Cloud-based backup can provide businesses with another location for storing protected copies of important information.

Potential advantages include:

Offsite storage

Automation

Scalability

Remote access to recovery infrastructure

Reduced dependence on local hardware

But “it’s in the cloud” does not automatically mean:

It’s backed up.

Cloud services vary considerably in their native recovery capabilities and retention.

The actual backup design needs to be understood.

Microsoft 365 Backup Considerations

Cloud services change the way businesses think about backups.

Your data may live in:

Exchange Online

OneDrive

SharePoint

Teams

Microsoft 365 provides native retention and recovery capabilities, but businesses should still determine whether those capabilities meet their own recovery requirements.

Computerist can help you understand what protection you currently have and where additional backup considerations may be appropriate.

OneDrive Is Not Automatically Your Entire Backup Strategy

OneDrive synchronisation is useful.

But synchronisation and backup solve different problems.

If a user deletes a file and that deletion synchronises across devices, synchronisation doesn’t necessarily provide the same protection as an independent backup with appropriate retention.

Likewise, if an account is compromised, you need to consider what an attacker could access or modify.

Cloud synchronisation is useful.

It shouldn’t automatically be treated as a complete disaster-recovery strategy.

SharePoint & Teams Data

Businesses often assume that because information is stored in Microsoft 365, it is automatically protected against every possible form of data loss.

That’s too simplistic.

Businesses should understand:

What is stored

Who can access it

What native recovery exists

How long deleted information remains recoverable

What happens after an account compromise

Whether additional backup is required

Computerist can help businesses review these considerations.

Server Backup

Businesses with physical or virtual servers may have additional recovery requirements.

A server backup strategy may need to protect:

Operating system

Applications

Databases

Files

Configuration

Virtual machines

System state

Application dependencies

The objective isn’t merely to recover a folder.

In some situations, the business needs to recover the whole service.

Virtual Machine Backup

Virtualised environments can simplify some aspects of backup and recovery.

Depending on the platform, backup may involve:

Virtual machines

Snapshots

Application-aware backups

Configuration

Host infrastructure

Offsite copies

Snapshots can be useful operationally, but they should not automatically be treated as a substitute for a properly designed backup strategy.

Endpoint & Laptop Backup

Employees increasingly work from laptops.

That creates an important question:

What happens if an employee’s laptop is lost tomorrow?

A business may need to recover:

Documents

Desktop files

User data

Application configuration

Business information

Cloud synchronisation, endpoint backup and other protection mechanisms can be considered depending on the environment.

Backup Security

Your backup contains valuable information.

That makes it a target.

A secure backup strategy should consider:

Authentication

Access control

Encryption

Administrator privileges

MFA

Network separation

Immutability where appropriate

Retention

Monitoring

Deletion protection

The Essential Eight guidance specifically addresses protecting backups from modification and deletion by inappropriate accounts.

A backup that an attacker can simply delete is a much weaker recovery control.

Immutable Backups

An immutable backup is designed so that protected backup data cannot be modified or deleted during a defined retention period.

This can be particularly valuable when considering ransomware.

The exact implementation depends on the backup platform and storage architecture.

Computerist can help businesses understand whether immutable or otherwise protected backups are appropriate for their environment.

Backup Encryption

Backup data may contain the same sensitive information as the production environment.

Encryption can help protect that information if backup storage is compromised or accessed without authorisation.

Encryption should be considered alongside:

Key management

Access control

Recovery requirements

Backup platform

Disaster Recovery Planning

Backup is only one part of disaster recovery.

A practical recovery plan should consider:

What happened?

Hardware failure?

Cyber attack?

Fire?

Flood?

Accidental deletion?

What systems are affected?

What needs to be restored first?

Where are the backups?

Who is responsible?

What dependencies exist?

How will users work while systems are being restored?

How do we know recovery is complete?

These questions turn backup into a real recovery strategy.

Disaster Recovery Isn’t Just an IT Problem

A major technology outage can affect:

Employees

Customers

Suppliers

Finance

Operations

Communication

Compliance

Management

IT can restore systems.

But the business needs to decide:

Which systems matter most?

How long can we operate without them?

What workaround exists?

Disaster recovery should therefore be aligned with business continuity.

Disaster Recovery Testing

A plan sitting in a document isn’t enough.

People need to know whether the plan works.

Testing can reveal:

Missing credentials

Unknown dependencies

Incorrect backup settings

Incomplete backups

Slow recovery

Missing documentation

Configuration problems

Unclear responsibilities

The ACSC recommends testing restoration as part of disaster-recovery exercises rather than waiting for a real incident.

Testing isn’t about proving everything is perfect.

It’s about discovering problems before the real disaster does.

What Happens If Your Primary Server Fails?

A sensible recovery plan might look something like:

1. Identify the failure

Determine whether the problem is hardware, software, storage or something else.

2. Protect the remaining environment

Prevent further damage.

3. Determine recovery priority

Identify the services that need to return first.

4. Select the recovery point

Choose an appropriate backup.

5. Restore

Recover the relevant system, application or data.

6. Validate

Confirm the restored service actually works.

7. Resume operations

Return users to the restored environment.

8. Investigate

Determine why the original failure occurred.

What Happens During a Ransomware Incident?

Ransomware recovery is different from ordinary hardware failure.

You need to consider:

Containment

Scope

Compromised devices

Compromised accounts

Backup integrity

Malware removal

Recovery order

Credentials

Security improvements

The ACSC advises checking that backups are free from ransomware before using them for recovery and recommends professional assistance if businesses suspect their backups may also be compromised.

Never assume that the newest backup is automatically the safest backup.

Don’t Build Your Recovery Plan Around Paying a Ransom

Paying a ransom doesn’t guarantee that data will be restored or that stolen information won’t be published.

The ACSC advises against paying ransomware demands.

A stronger strategy is:

Prevent where possible.

Detect quickly.

Contain the incident.

Recover from clean backups.

Improve the environment afterwards.

Backup & Disaster Recovery Assessment

If you’re unsure whether your existing backup strategy is actually adequate, Computerist can help review it.

We can consider areas such as:

What is being backed up?

How often?

Where?

For how long?

Who can access it?

Can backups be deleted?

Are copies offsite?

Are backups protected against ransomware?

Have restores been tested?

What systems are critical?

How quickly do they need to return?

The goal isn’t to sell you more storage.

It’s to determine whether your recovery strategy actually matches your business needs.

Common Backup Mistakes

“We have a USB drive.”

A single backup drive isn’t necessarily a complete business continuity strategy.

“Microsoft 365 is in the cloud.”

Cloud availability and independent backup/recovery are not necessarily the same thing.

“The backup software says successful.”

A successful job doesn’t prove the restore will work.

“We have RAID.”

RAID can improve availability, but it isn’t a backup.

“We have snapshots.”

Snapshots can be useful, but they aren’t automatically a substitute for independent backups.

“The backup is connected to the server.”

If ransomware can access the production environment and the backup using the same credentials or network path, both may be at risk.

“We’ve never needed to restore anything.”

That’s precisely why recovery testing matters.

RAID Is Not Backup

This deserves its own warning.

RAID can provide redundancy against certain hardware failures.

It does not protect against:

Accidental deletion

Ransomware

Corruption

Malicious activity

Fire

Theft

Many software failures

RAID helps keep systems available.

Backup helps recover data.

They solve different problems.

Backup & Disaster Recovery for Small Business

Small businesses don’t necessarily need an enormous enterprise disaster-recovery environment.

But they do need to understand:

What matters.

What can be lost.

How quickly recovery is required.

Where backups are stored.

Who can access them.

Whether recovery has been tested.

A sensible small-business strategy can often be considerably simpler than an enterprise architecture.

The important thing is that it is appropriate and actually works.

Backup & Disaster Recovery for Microsoft 365

If your business relies heavily on Microsoft 365, your recovery strategy should account for the services you use.

This may include:

Exchange Online

OneDrive

SharePoint

Teams

Microsoft Entra ID

User accounts

Business data

Computerist can help you understand the recovery capabilities available in your Microsoft 365 environment and identify where additional protection may be appropriate.

Backup & Disaster Recovery for Servers

If your business relies on servers, recovery planning becomes even more important.

We can help consider:

Server backup

Application backup

File backup

Virtual machines

System recovery

Offsite protection

Recovery priorities

Testing

What Happens When You Contact Computerist?

1. Understand your business

We first establish what systems and information your business depends on.

2. Identify critical data

Not every file has the same recovery priority.

3. Review your current backups

We’ll look at what is being protected and how.

4. Identify weaknesses

This may include:

Missing data

Poor retention

Lack of offsite copies

Weak access controls

No recovery testing

Insufficient recovery objectives

5. Prioritise improvements

We’ll identify what should be addressed first.

6. Implement the agreed solution

This may involve backup configuration, additional protection, documentation or recovery planning.

7. Test

Where appropriate, we’ll test restoration rather than simply assuming it works.

8. Document

Recovery procedures and important technical information should be documented so that recovery doesn’t depend entirely on someone’s memory.